fix(07.3): add global ES256 test key fixture to conftest.py

After the ES256 upgrade, create_access_token requires non-empty
jwt_private_key / jwt_public_key. The auth_user, second_auth_user,
and admin_user fixtures in conftest.py call create_access_token
without keys being set, breaking all tests that exercise the auth
system. Add a function-scoped autouse fixture that provisions a
generated P-256 keypair for every test.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/conftest.py

@@ -16,11 +16,14 @@ SQLite compatibility note:
 """
 from __future__ import annotations
 
+import base64
 import os
 import socket
 
 import pytest
 import pytest_asyncio
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives import serialization
 from httpx import ASGITransport, AsyncClient
 from sqlalchemy import String, Text
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
@@ -155,6 +158,39 @@ async def async_client(db_session: AsyncSession):
     app.dependency_overrides.clear()
 
 
+# ── ES256 test key provisioning — required by all tests after Phase 7.3 ──────
+
+def _generate_es256_test_keys():
+    private_key = ec.generate_private_key(ec.SECP256R1())
+    priv_pem = private_key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    )
+    pub_pem = private_key.public_key().public_bytes(
+        serialization.Encoding.PEM,
+        serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+    return base64.b64encode(priv_pem).decode(), base64.b64encode(pub_pem).decode()
+
+
+_TEST_JWT_PRIVATE_KEY, _TEST_JWT_PUBLIC_KEY = _generate_es256_test_keys()
+
+
+@pytest.fixture(autouse=True)
+def _patch_es256_test_keys(monkeypatch):
+    """Provide valid ES256 test keys to every test (Phase 7.3+).
+
+    create_access_token and create_password_reset_token require non-empty
+    jwt_private_key / jwt_public_key after the ES256 upgrade. Without this
+    fixture, any test that calls those functions fails with ValueError.
+    Keys are generated once at module load and reused across tests for speed.
+    """
+    import config
+    monkeypatch.setattr(config.settings, "jwt_private_key", _TEST_JWT_PRIVATE_KEY, raising=False)
+    monkeypatch.setattr(config.settings, "jwt_public_key", _TEST_JWT_PUBLIC_KEY, raising=False)
+
+
 # ── Rate limiter reset — prevents cross-test contamination ───────────────────
 
 @pytest.fixture(autouse=True)